CVE-2024-25617: netapp bluexp Collapse of Data into Unsafe Value
Vulnerability summary
CVE-2024-25617 is a high (CVSS 7.5) Collapse of Data into Unsafe Value vulnerability in netapp bluexp. EPSS estimates a 88.09% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 14 · Related 6Timeline
- 14-02-2024PublishedVulnerability first disclosed.
- 13-02-2025Last modifiedVulnerability information updated.
Description
Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Collapse of Data into Unsafe Value bug ,Squid may be vulnerable to a Denial of Service attack against HTTP header parsing. This problem allows a remote client or a remote server to perform Denial of Service when sending oversized headers in HTTP messages. In versions of Squid prior to 6.5 this can be achieved if the request_header_max_size or reply_header_max_size settings are unchanged from the default. In Squid version 6.5 and later, the default setting of these parameters is safe. Squid will emit a critical warning in cache.log if the administrator is setting these parameters to unsafe values. Squid will not at this time prevent these settings from being changed to unsafe values. Users are advised to upgrade to version 6.5. There are no known workarounds for this vulnerability. This issue is also tracked as SQUID-2024:2
CVSS metrics
5 scores · 5 sources · 1 version- CVE.orgCNA5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · Red hatEcosystem advisory · calculated8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
88.09%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 88.09% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-182Collapse of Data into Unsafe ValueThe product filters data in a way that causes it to be reduced or "collapsed" into an unsafe value that violates an expected security property.
- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
Affected systems
Redhat7 products
- libecap< 0:1.0.1-2.module+el8.1.0+4044+36416a77
- libecap-debuginfo< 0:1.0.1-2.module+el8.1.0+4044+36416a77
- libecap-debugsource< 0:1.0.1-2.module+el8.1.0+4044+36416a77
- libecap-devel< 0:1.0.1-2.module+el8.1.0+4044+36416a77
- squid< 7:4.15-6.module+el8.8.0+21374+5b4927f1.4 | < 7:4.15-3.module+el8.6.0+21376+425c674a.5 | < 7:5.5-5.el9_2.5
Ubuntu2 products
- squid< 4.10-1ubuntu1.10 | < 5.7-0ubuntu0.22.04.4 | < 6.5-1ubuntu1
- squid3< 3.5.12-1ubuntu7.16+esm3 | < 3.5.27-1ubuntu1.14+esm2
Debian1 product
- squid< 5.7-2+deb12u1 | < 6.5-1
Netapp1 product
- bluexpna
Squid-cache1 product
- squid< 6.5 | ≥ 3.0, < 6.5
5 vendors · 12 products
References
19 links- github.com/squid-cache/squid/security/advisories/GHSA-h5x6-w8mv-xfprX Refsource CONFIRMARTICLEREPORTMitigationThird Party AdvisoryVendor Advisory
- github.com/squid-cache/squid/commit/72a3bbd5e431597c3fdb56d752bc56b010ba3817X Refsource MISCPatchVendor Advisory
